Azure splits logging into three groups. The activity log covers subscription-level events and is collected automatically. Resource logs cover what happens inside a resource, and need a diagnostic setting. Microsoft Entra audit and sign-in logs cover identity activity. Know which you have before an incident.
The three groups
Microsoft's Azure Monitor documentation lays them out:
- Activity log: What it shows: Subscription-level events, including configuration changes and service health; How it is collected: Automatically. You can send it to a Log Analytics workspace at no charge.
- Resource logs: What it shows: Operations performed inside a resource, with content that varies by service; How it is collected: Only after you create a diagnostic setting
- Microsoft Entra audit and sign-in logs: What it shows: History of sign-ins and an audit trail of tenant changes; How it is collected: Collected automatically, and viewable in the portal
Platform metrics are collected automatically as well, but they are numbers over time, not event records.
Why resource logs surprise people
The activity log tells you that someone created a storage account or changed a setting. It does not tell you who read a blob. That detail lives in resource logs, and they only exist if a diagnostic setting is turned on for that resource.
A diagnostic setting sends the data to one or more places. Microsoft lists a Log Analytics workspace, a storage account for archive, or an event hub to stream to tools outside Azure.
A simple baseline
- Send the activity log somewhere you control. It is collected automatically, but a diagnostic setting lets you keep it in your own workspace or archive.
- Send Entra audit and sign-in logs to the same place, so identity and resource events can be searched together.
- Turn on resource logs for the resources that matter most. Storage accounts, key vaults and databases come first.
- Decide retention and cost on purpose. Microsoft warns there is a cost to collecting and keeping most Azure Monitor data, and advises collecting only what you need.
Doing step 3 through policy, so that new resources get a diagnostic setting automatically, is better than relying on people to remember.
Virtual machines and containers
Azure VMs produce the same activity logs and platform metrics as other resources. Logs from inside the guest operating system need the Azure Monitor Agent and a data collection rule. AKS clusters likewise need extra steps, such as Container Insights, for cluster logs.
What to check this week
- Does each subscription have a diagnostic setting for its activity log?
- Are Entra sign-in logs going to a workspace you can query?
- For your top five sensitive resources, can you list who accessed them last Tuesday?
If you cannot answer the last one, resource logs are your gap.
Quick check
Is the activity log free to keep?
Microsoft says you can collect it in a Log Analytics workspace at no charge. Other destinations and retention choices may cost money, so check your own pricing.
Do I need diagnostic settings for Entra logs?
Entra logs are collected automatically, but a diagnostic setting is how you send them to a workspace, archive or event hub.
Sources
Last reviewed: 19 October 2026.
